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al from Moog to Skyryse? 
2 A. That's my understanding. 
3 0. And what were you asked to analyze with 


4 respect to Reid Raithel? 


5 A. With Reid, it was primarily information 
6 surrounding his use of a USB drive. 
7 Q. You say information surrounding his use 


8 of a USB drive. If I look at paragraph 51 of 
9 Mr. Raithel's declaration, you identify two 
10 different USB drives, correct, USB 1 and USB 2? 


11 A. Correct. 


16 CG. When I asked you just now about what 
7 you were asked to do with respect to Reid 
18 Raithel, you said that you were asked to analyze 


19 his activity with respect to a USB drive. 


20 So I'm just trying to confirm, were you 
Zi asked to analyze one of the two USB drives or 
22 were you asked to analyze his usage with both? 
23 A. I guess in the larger context, both. 
24 0. Did you review an image or file log for 


25 USB 2 in the course of your analysis? 
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A from Mr. Raithel's Moog laptop indicates that 
S over 27,000 files were copied to USB 2." 


3 Do you see that? 


13 BY MS. ANDOH: 
14 0. Did you look at any transfers that 


15 Mr. Raithel made, beyond the ones that were 


16 identified in the Pixley declaration? 

17 A. I'm not sure what you are referring to. 
18 oF Are you aware of Mr. Pixley's 

19 declaration? 

20 A. I am. 

21 Oo. You just said that you didn't look at 


22 all 27,000 files to see if they were on 
23 Mr. Raithel's laptop. 
24 I'm now asking you did you search for 


25 any files that were on the USB 2 drive, other 
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at A. COLrect . 

2 OQ. So how do you know that the logs 

3 contain no indication that a device like CF 

4 1798654321 was ever connected to Mr. Raithel's 


5 Skyryse laptop? 


6 THE WITNESS: I'm sorry, someone else 

7 was saying something. I don't know if that was 

8 Russ or somebody else. If so, I didn't hear him. 
o MR. MANGAS: No, I didn't say anything. 
10 MS. ANDOH: Ms. Countz, could you 


i please reread the question? Thank you. 


12 (The record was read by the reporter.) 
13 THE WITNESS: Because I reviewed the 
14 logs. 


LS BY MS. ANDOH: 
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looked at all the logs. 
OQ. I'm not asking about the logs. 

Did you, took in the dally ou legs to 
see if there was evidence of any device other 
than the two devices Mr. Pixley reviewed? 

MR. MANGAS: Ob jecticn. I'm sorry, 
Mike. Give me one second. 

Objection, outside the scope. To the 
extent you are asking him to give other than the 
contents of the report, I think it's outside the 
scope. 

MS. CANDOR: 7 i monet. 2m asking hin 
whether he reviewed them in connection with this 
declaration. 

MR. MANGAS: Sorry, let me state my 
objection. 

Mr. Bandemer's opinion is limited to 
whether USB 2 was ever connected. So I think to 
the extent you are asking him about connections 
Gther ‘thanvUSB 2) abs “outside the scope, (Soxel'm 
lodging that objection. 

Mr. Bandemer, if you can answer the 
question, you can go ahead and answer it. 

THE WITNESS: Madam Court Reporter, if 


you could repeat the question, please. 
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il (The record was read by the reporter.) 
2 THE WETNESS: So given all the 

2 objections and everything here, what I can say is 
4 I looked through all of the logs to identify 

5 whether or not a device like USB 2 was connected, 
6 andU Ge iwas Tnoce 

Y BY MS. ANDOH: 

8 Oo. Isn't it true that materials could have 
oI been transferred from USB 2 to another device 

10 that was then connected to Mr. Raithel's laptop? 
pkil MR. MANGAS: Objection to form. 

12 THE “WLITNESS® “So -l meed to ask you to 


13 clarify. What is the question? 


14 MS. ANDOH: Ms. Countz, can you please 
15 read the guestion back? 

16 (The record was read by the reporter.) 
17 THE WITNESS: So you're saying outside 


18 of the scope of this laptop? 

HS) BY MS. ANDOH: 

20 OL No. What I asked you was -- 

21 A. I mean this device was -- based on 


22 these logs, this device was not plugged into this 


23 laptop. So I don't know what context you are 
24 giving me for this question. 
25 OL in preparing this opinion; did you 
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0. Okay. Please turn to paragraph 16 of 
your declaration. 

MS. ANDOH: Actually, before we do 
that, we've been going for about an hour. Why 
don't we take a break for about five minutes and 
then we can go back. This is a good time to do 
that. 

MR. MANGAS: Okay. 

THE WITNESS: What time do you want to 
be back on? 

MS. ANDOH: It's five past right now so 
why don't we say ten past? 

MR. MANGAS: Okay. 

THE VIDEOGRAPHER: This marks the end 
of media number 3. The time is 9:04. We are off 
the record. 

(Break taken.) 

THE VIDEOGRAPHER: This marks the 


beginning of media number 4. The time is 9:14 
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dy a.m. We are on the record. 
2 BY MS. ANDOH: 
3 0. Mr. Bandemer, I'm going to refer you to 
4 page 5 of your declaration which is paragraph 16. 
5 A. Okay. 


18 Q Did you use an E01 to conduct your 

19 review of the deleted files? 

20 A. Y@s'. 

21 ep And what is an E01? 

22 A. It's an image -- it's a forensic image 
23 container. 

24 O. And when you say it's a forensic image 
25 container, it contains a complete forensic image 
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al specific because your question is unclear as to 
2 what you are asking me. I just asked for a 
3 clarification and you didn't refer to it. You 
4 need to be more specific. 
5 0. Did you review the file names of these 
6 3,299 files to see if the file names were 
7 consistent with the Atmel microcontroller 
8 OLOGUeEs 
S A. I reviewed the folder generally. 
10 OO What do you mean by reviewed the folder 


tl generally? What steps did you take? 
12 TNs Well, I browsed the directory. 
1s Or And what did you find when you browsed 


14 the directory? 


15 A. That it was all consistent with the 

16 folder description of Atmel microcontroller. 

wy, On And when you say you browsed the 

18 folder, did you read every one of the file names? 
is) A. So you have to realize in forensics 

20 this is not E-discovery and when we find 

21 information like this, what we're doing here is 


22 very standard. We have identified the folder and 
23 the contents and we browsed it generally. 
24 Bue did 1 open 2,299 tiles? No. “Did 1 


25 find the need to? No. Did everything that I 
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il viewed in that folder appear to be consistent 


2 with the rest of the contents? Yes. 
3 Or. All right. Your next sentence says: 
4 "An additional 9,525 files are found within a 


5 ClecuLEPyehou tolder.." 


6 Do you see that? 

UI A. Nese 

8 On And then you say: "My research 

2) indicates that CircuitPython is a programming 
10 language used to learn code, to code on low-cost 


alal MLCEOCCOnELroOLler boaras. " 


12 Do you see that? 
ue! A. Yes. 
14 Or With respect to the CircuitPython 


LS folder, did you also review the folder generally 
16 by browsing the directory of the folder? 

mM A. Conprecc. 

18 Og And you did not open each one of those 
19 9,521 files specifically to see what they were? 
20 A. I'm sorry, are you asking if I opened 


PANN ali of the 9,525 files? 


ERA OE Yes. 

23 A. LodiG not, 

24 ©. All rroht. “And. you go .on to say: “An 
es additional 4,137 files are found in a Myarduino 


Zz ESQUIRE 800.211.DEPO (3376) 


EsquireSolutions.com 


Case 2:22-cv-09094-GW-MAR Document 508-5 Filed 06/01/23 Page 14 of 33 Page ID 


#:16417 
MICHAEL BANDEMER May 26, 2023 
MOOG vs SKYRYSE, INC. pes: 
i Lolder 7" 
2 MS. ANDOH: For the court reporter 


3 Ene Ss eMaY=ASRep UST N=Os 


4 BY Ms. ANDO: 


5 O- Do you see that? 

6 A. Are you asking me or the court 

7 hepehier: 

8 O- No, I'm asking you do you see it? 

9 A. Mes: 

10 On And you Say; "“Mydrduinoe ws a4 

ed commercially-available third-party platform often 
12 used by hobbyists to create electronic projects." 
13 Do you see that? 

14 A. Is that your guestion, whether I see it 
15 Om Noe: 

16 0. Yes, my guestion is whether you see it. 
ey A. Lvdo. 

18 Oe And IT just wank to confiirm thar you 

iu) also reviewed the folder generally from Myarduino 


20 which include browsing the directory of the 

2) folder but not opening each of the 4,137 files? 
22 Th Yes, I browsed it and looked at the 

23 content to see if it was consistent with the 

24 description of the folder and everything appeared 


25 COnelstent with that. 
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af ©. You next say: "Another 4,327 files are 
2 found in an HDHomeRun folder. HDHomeRun is a 


3 third-party product designed to allow individuals 


4 to watch live and reported television programs on 
5 a computer network." 

6 Do you see that? 

7 A. IL aS; 

8 OQ; And I'll ask you the same question. 

cS) Did you review the folder generally, 


10 meaning you browsed the directory of a folder but 


11 you didn't open each of the 4,327 files? 


ae A. I did not open each of the 4,327 files. 
13 0. And finally, you say that: "Another 
14 5,600 files are found in a ballard driver folder. 


15 A driver is a set of instructions that allows the 


16 computer to understand how to use a device that 
7 is connected to it." 

18 Do you see that? 

19 A. LT es 


25 QO. So if I do some back of the envelope 
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the contents of these other 12,390 files are, 
FLOht? 

A. Well, as I said, it's not a -- what's 
the best word? So having been involved in a lot 
of these types of matters, it's not a curated 
library. A lot of it just appears to be personal 
mish-mash of materials. 

T've identified here the major folders 
that have a large volume of content. The other 
stuff is a mish-mash of, you know, what appears 
to be like hobbyist-type files and personal 
files. 

SO I don’t want to say <= I"m sorry, 1 
hadn't finished. Do you want to interject. 

ae Go ahead. 

A. So, I don't want to agree with your 


representation because that's not exactly true. 
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18 Q So sitting here today, are you telling 
19 me that it's your opinion that none of the 39,278 
20 files that we're discussing belong to Moog? 

2. A. Again, I'm not sure what I could add to 
a2 my prior answer other than to say that I've 

23 discussed and written in my declaration exactly 


24 what I did and it's within the scope of my work. 


25 It's not reasonable within a forensic 
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di what line you're on? 
2 ay T'm on paragraph 45, line 15. 
3 A. 1. got that. 
4 0. If you don't talk over me I think you 


5 would hear better where I'm directing you. 

6 A. Well, actually, you didn't -- 

7 Q. I did. I specified line 15 four times 
8 now and I'm going to do it a fifth. 

9 We are on paragraph 45, line 15, and it 
10 says: "Mr. Pixley does not specify which, if 


al any, of the 39,278 files contained alleged 


12 confidential or proprietary data owned by Moog." 
13 Do you see that? 
14 A. I do. Thank you for finally directing 


alk me to that line. 
16 Q. Again, I think if you don't talk over 


L? me you will discover that I direct you to these 


18 lines. 
19 It then goes on, beginning on line 18, 
20 to say: "I understand from Mr. Bayer's 


21 declaration that these do not appear to be Moog 


22 confidential or proprietary information." 
23 Do you see that? 
24 A. I do, 
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ul 20 in paragraph 45 is you opining on whether any 
2 of these materials are confidential or 


6} proprietary data owned by Moog. 


4 i Just want to be contirm, is that 

5 correct, that you are not opining on that? 

6 A. Not opining on what? 

7 OF On whether any of these 39,278 files 

8 contain alleged confidential or proprietary data 


o owned by Moog? 


10 A. Yeah, it's not within the scope of my 
te expertise to make a determination as to whether a 
12 particular file and its contents are Moog or 


13 Skyryse. And I'm just pointing out that Pixley 


14 doesn't specify and does not elaborate on the 

15 contents of this material. 

16 So it is unreasonable for someone to go 
Al 7) open 39,000 files, at least from a forensic 


18 Standpoint. And so Mr. Pixley doesn't do it and 
is) he doesn't specify it and so there's no way for 
20 me to respond to it. 

Zl Because if he had, then I could 

22 potentially respond to it but he didn't. And 

23 that’s what 1'mM trying CO pPOlnt Cut there iam Chis 
24 DalbagGraph and, as you point ouit, lines 15 through 


Oe) Ze 
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dy onto your laptop? 
2 A. Not without a record of it. 
G QO. Okay. Did you review system logs to 
4 see if there were any records of documents from 


5 the USB drive being opened on the laptop? 
6 A. Well, that wasn't something reported by 
7 Mr. Pixley so that would be outside the scope of 


8 Mr. Pixley's declaration. 


2) Ou So it was outside the scope of your 
10 analysis? 
a. A. The issue that was raised was the 


b2 copying of these files and this particular folder 
ie to his laptop. And so I have addressed that 


14 here. Mr. Pixley doesn't go beyond that so I'm 


15 addressing what it is he stated in his 

16 declaration. 

ay, If there were some kind of concern or 
18 evidence in that regard, that I'm sure Mr. Pixley 


ne would have brought that to everyone's attention. 
20 Q. So you Gid not vanaly ze, Was part oF your 
PAN work for this declaration, how many times that 

22 USB drive was plugged into Tri Dao's Skyryse 

a3 computer, right? 

24 A. Again, that's a completely different 


25 subject than what I reported on. 
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24 


ao 


©.» And in your work for this declaration, 
you didn't analyze whether any of the documents 
from that USB were opened on the USB while it was 
connected to Tri Dao's Skyryse laptop, right? 

A. Well, let me refer to my report for a 
second. (Perusing. ) 

So if you refer to paragraph 47, you 
will see the two files that I identified were 
opened from the Myarduino folder. 

0. But that's from the C drive, right? He 
opened them from his Skyryse laptop, not from the 


USB, right? 


A. Correct, there is no evidence of him 
opening them from the USB -- I'm sorry, the thumb 
drive. 

0. Did you review his system logs to see 


whether he had opened files from his USB drive, 
or did you only look to see if the files from his 
laptop had been opened? 


A. No, I reviewed all of the forensic 
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THE VIDEOGRAPHER: This marks the 
beginning of media number 6. The timing is 10:57 
a.m. We are on the record. 

MS. ANDOH: Thank you. 


BY MS. ANDOH: 


Os Did you look to see whether Mr. Dao had 


any transfers from that USB drive, other than the 
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Af one that Mr. Pixley identified, to his Skyryse 


se, laptop? 


3 A. In what sense? 

4 ee Well, you refer to Mr. Pixley's 

5 declaration where he opines about a transfer that 
6 occurred of 7,679 files. 

7 I'm asking whether you did any work to 
8 see if there were any other transfers from the 


o USB drive other than that one that Mr. Pixley 

10 describes? 

11 A. Yeah. I might not be clear on exactly 
12 what you're talking about. But Mr. Pixley 
13 identifies a transfer. Are you asking whether he 
14 should have looked at other devices or did I go 
15 beyond the scope of his analysis? 
16 I'm not really sure what you are asking 


17 about. 


Zz ESQUIRE 800.211.DEPO (3376) 


EsquireSolutions.com 


Case 2:22-cv-09094-GW-MAR Document 508-5 Filed 06/01/23 Page 24 of 33 Page ID 


#:16427 
MICHAEL BANDEMER May 26, 2023 
MOOG vs SKYRYSE, INC. 99 

il A. Yes. I looked at what Mr. Pixley 

Z identified in his declaration and I looked at 

3 je leystio, 

4 QO. So you did not look at whether there 

5 were any other transfers off of that USB drive to 
6 the laptop? 

q A. Well, you say that but to where? What 
8 is the question, exactly? The transfer is to 

2) where? 

10 On The question is did you 

tl identify -- strike that. 

12 Did you do any analysis to determine 

13 whether there were any downloads from the USB 

14 drive to the laptop, other than the one that Mr. 
1S Pixley discussed in his declaration? 

iG A. Mess 

ay, On And what was that work that you 

18 performed? 

US) A. So we looked at the duration of the USB 
20 connection information and looked at every file 
Zl created on the machine during that timeframe. 
22 On So you looked at the duration of the 
22 USB connection on the date that Mr. Pixley 
24 identified the transfer occurred? 
Zo A. COLBect. 
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Ox And did you look to see whether the USB 


was connected at any other time? 

A I'm sure that Mr. Pixley, if that were 
the state of things, would have identified that. 
And so he didn't. 

And so the primary focus of Mr. 
Pixley's analysis is related to this USB device 
and these 7600 files which we were able to 
confirm and you can see my analysis of the 
contents of those. 

So there's no other evidence that there 
was some other interaction. 

OF I'm not asking what Mr. Pixley did, i'm 
asking what you did. 

I'm asking did you personally look to 
see whether the USB was connected to the laptop 
at any time other than the one instance Mr. 
Pixley put in his declaration? 

a Well, that was the focus of our 
analysis because obviously Mr. Pixley would have 
done that and he clearly identified an 
interaction with the files. And so that was the 
scope of our investigation. 

Os Again, you're not answering my 


question. 
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Did you look to see whether the USB 
drive was connected to the Skyryse laptop at any 


time other than the one download that Mr. Pixley 


identified? 
A. Okay, so you're using the word 
"download" but that's out of context here. So I 


think you're going to have to rephrase that 
question to make sure it's clear. 

oO. Did you look to see if there was any 
instance other than the one that Mr. Pixley 
identified in his declaration where the USB drive 
was connected to the laptop? 

A. I'm not sure how to answer this any 
differently. We looked at the connection about a 
particular device and it was approximately, what, 
three or four minutes. And we looked at 
everything that was created on the computer 


during that timeframe. 
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described in Mr. Pixley's declaration? 

A. Yeah. I can't recall. Obviously we 
are focused on that because that's what Mr. 
Pixley identifies. But we did not observe any 
other uploads. If we had, we would have reported 
One UG; 

OF So you can't recall whether you 
performed that analysis or not? 

A. NOt that iecan"t recall, What. i'm 
Saying is there was no reportable incidents there 
and there is nothing outside of the scope of what 
Mr. Pixley identified that we found to report on. 

On Mow just Said that you can’t recall 
whether there were any instances. Now you are 
Saying that there weren't? 

MR. MANGAS: Objection to form. 

THE WITNESS: What I'm saying is Mr. 
Pixley reported on a particular incident and 
we've investigated that incident and we observed 
when this USB was connected. 

There were no other connections that we 
had to report on. 
BY MS. ANDOH: 

Q. Do you have an opinion as to where the 


39,000-plus files on the USB drive originally 
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USB connected device. 
OQ. So the Ivanti log -- let me try to 


paraphrase this just so we are on the same 
page -- is a log that essentially shows 
connections of external devices to a computer 
that is on its system? 


A. In part, yes. 


MS. ANDOH: All right. I'm going to 
drop a native version of the Ivanti log into the 
chat because I think it's going to be much easier 
for you to use than a PDF version, which is 
basically unintelligible. 

It says Exhibit 7 but it's actually 
going to be marked as Exhibit 4, just for the 
record. 

THE WITNESS: (Perusing. ) 

(Bandemer Exhibit 4, Native 

Version of the Ivanti Log, was 


marked for identification. ) 
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the record it will be Exhibit 4 but we can just 
refer to it as the Tri Dao Ivanti log, okay? 

A. Okay. 

oF So the thing that I would like to ask 
you first is how many devices are represented on 
this log? 

A. Well, it would be any device that he's 
connected to his computer is going to get 
recorded by Ivanti. 

O: And if I were to ask you on this log 
what column shows me what device is being 
connected at what time, what letter column would 
that be? 

A. Sorry, you cut out there for a second 
but I think you asked me what column displays the 


device name, and that's column E. 


Ox The column called "Display Name", 
COLTEect = 

A. COLrrect. 

Q. So I just want you to confirm by 


clicking on the filter that there are four 
different devices that are represented by this 


log, is that right? 


A. Correct. 
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18 Q So just so that we are clear, you did 
19 not look in Tri Dao's Skyryse laptop logs to see 
20 whether any of these other devices had been 

Zi connected? 

22 A. That's not true. 

23 Q. So what other of these four devices did 
24 you investigate with respect to connections to 


25 Tri Dao's Skyryse laptop? 
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rephrase that question because that's not what I 
said, 

O. I'm asking you my question. 

Did you review every connection to Tri 
Dao's laptop for the duration of Mr. Dao's 
employment with Skyryse? 

A. So, we looked at the connection history 
that's in this log and we were able to confirm 
what it is Mr. Pixley said. Even though he 
didn't specifically identify in his declaration, 
we were able to recreate it and that's what we've 
reported on. 

I'm not really sure what you're asking 


beyond that. 
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QO. Okay, so you didn't? 


MR. MANGAS: Objection to form. 


BY MS. ANDOH: 


O« Let's move on to your paragraph 49. 
A. I'm sorry, what paragraph? 
QO. Sorry, hold on one second. Paragraph 


49, page 14, line 13. 

A. Okay. 

ae You refer in paragraph 49 to 11 Excel 
spreadsheets that Mr. Pixley located on Eric 
Chung's Skyryse-issued computer. 


Do you see that? 


A. L-Gies 
QO. And then in paragraph 50 in the first 
sentence on line 18 you say: "In Mr. Bayer's 


declaration he analyzes several Zip files from 
Eric Chung's Moog laptop." 
Do you see that? 
A. L de, 
On And I was personally confused by these 
two paragraphs so I just want some clarification. 


Are you trying to say that the 11 Excel 
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1 STATE OF CALIFORNIA ) ao 
2 COUNTY OF LOS ANGELES ) 
3 I, BRENDA R. COUNTZ, Certified Shorthand 
4 Reporter No. 12563 for the State of California, 


iS) do hereby certify: 

6 That prior to being examined, the 

7 witness named in the foregoing deposition was 

8 duly sworn to testify the truth, the whole truth, 


9 and nothing but the truth; 


10 That said deposition was taken down by 
11 me in shorthand at the time and place therein 

12 named and thereafter transcribed and that the 

13 Same is a true, correct, and complete transcript 
14 of said proceedings. 

ale Before completion of the deposition, 

16 review of the transcript [ ] was [ ] was not 


Lt requested. If requested, any changes made by the 
18 deponent during the period allowed are appended 
ig Nerelo:« 

20) I further certify that I am not 


21 interested in the outcome of the action. 


22 Witness my hand Ss 30th daygof May 


Brenda R. Countz, CSR No. 
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